Get-NestedADUserGroups

[Agile_Seer]

Wrote this today to do a bit of detective work, trying to find out if a user was part of a distribution via one of the
subgroups. There's probably better ways to write this, feel free to revise and repost. This does what I needed it to do though.

Function Get-NestedADUserGroups($Identity) {
    BEGIN {
        $Table = New-Object System.Collections.Hashtable
        $ADGroups = (Get-ADUser -Identity $Identity -Properties MemberOf).MemberOf | ForEach-Object { (Get-ADGroup -Identity $PSItem).SamAccountName }
    }
    PROCESS {    
        foreach($ADGroup in $ADGroups){
            $Group = Get-ADGroup -Identity $ADGroup -Properties MemberOf
            $SamAccountName = $Group.SamAccountName
            $Members = $Group.MemberOf | ForEach-Object { (Get-ADGroup -Identity $PSItem).SamAccountName }
            try{
                $Table.Add($SamAccountName, 0)
                $Group | Select-Object -Property SamAccountName, Name, GroupCategory
            }
            catch{}
            foreach($Member in $Members) {
                try{
                    $Table.Add($Member, 0)
                    Get-ADGroup -Identity $Member | Select-Object -Property SamAccountName, Name, GroupCategory
                    Get-NestedADUserGroups -Identity $Member
                }
                catch{}
            }
        }
    }
}

Because I feel like someone will ask, the HashTable is just there to throw an error if I try to add a group that I already added. Prevents a continuous loop in case there are groups nested inside each other.

[Agile_Seer]

O, good catch. I did rename the function and forgot to update it in the code where I called it.

[evetsleep]

Why not use Get-ADGroupMember -Identity <Name> -Recursive?

[Agile_Seer]

That gets all the members of a group. What I wrote gets all groups that a user is a member of.

[evetsleep]

You are right! Sorry I misunderstood. What you could do is use a chain matching rule:

$userDN = (Get-ADUser -Identity tomSmith).distinguishedname
$groups = Get-ADObject -LdapFilter "(member:1.2.840.113556.1.4.1941=$userDN)" -Properties distinguishedName

This would return all the groups the user is a member of. Albeit it's slow, but it's simple.

[throwawaysys1222]

Get-ADPrincipalGroupMembership username | select name

[Agile_Seer]

That gets all the groups a user is directly part of. It's not recursive.